name: Desktop Nightly

on:
  schedule:
    - cron: "0 15 * * *"
  workflow_dispatch:

permissions:
  contents: read
  actions: read

concurrency:
  group: desktop-nightly
  cancel-in-progress: false

jobs:
  # Local calls deliberately follow the same immutable main commit as this run.
  verify:
    if: github.ref == 'refs/heads/main'
    uses: ./.github/workflows/desktop_ci.yaml # zizmor: ignore[self-repository]
    with:
      rebuild_cloudsync: true
    # Both internal workflows run only trusted main and use the existing build secrets.
    secrets: inherit # zizmor: ignore[secrets-inherit]

  build-and-publish:
    needs: verify
    permissions:
      contents: write
      actions: read
      id-token: write
    uses: ./.github/workflows/desktop_cd.yaml # zizmor: ignore[self-repository]
    with:
      channel: nightly
      candidate_sha: ${{ github.sha }}
      include_windows: true
      include_linux: true
    # Both internal workflows run only trusted main and use the existing build secrets.
    secrets: inherit # zizmor: ignore[secrets-inherit]